OSF Healthcare Settles HIPAA Violations Over Ransomware Attack Affecting 54,000 Patients

OSF Healthcare System agreed to pay a $552,250 penalty to resolve OCR findings that it failed to conduct proper risk analyses and timely notify patients after a ransomware attack exfiltrated protected health information.

Key Points:

• OSF Healthcare paid $552,250 to settle alleged violations of HIPAA Privacy, Security, and Breach Notification Rules.
• A ransomware attack in April 2021 led to the exfiltration of protected health information for 53,907 patients.
• The Office for Civil Rights cited failures in conducting accurate risk analyses and issuing timely breach notifications.
• The settlement requires OSF Healthcare to implement a corrective action plan and undergo two years of compliance monitoring.
• This is the largest HIPAA penalty collected by the OCR in the current year, totaling eight settlements so far.

OSF Healthcare System, an integrated health system operating 16 hospitals across Illinois and Michigan, agreed to a financial penalty after the Office for Civil Rights (OCR) determined it violated HIPAA regulations. The investigation stemmed from a ransomware attack discovered on April 23, 2021, where a variant of Nephilim ransomware encrypted files and demanded payment. Forensic analysis later confirmed that the protected health information of 53,907 patients was stolen, including names, driver’s license numbers, diagnosis details, and financial account information.

How can healthcare organizations ensure their risk analysis processes are thorough enough to prevent ransomware attacks before they occur?

Learn More: HIPAA Journal

Want to stay updated on the latest cyber threats?

👉 [Subscribe to r/PwnHub](https://www.reddit.com/r/pwnhub)